create table show incident close reason group by incident type

[LinsongGuo]

I am new to XSOAR and I am trying to create table show incident close reason group by incident type looks like below

	Ture positive	False positive	Duplicate
incident type 1	1	2	11
incident type 2	2	4	33
incident type 3	4	16	22

I cant find any widget can do this so I try to look into the automation script but I have no idea how it going to work.

If anyone can give a hit on this would be great?

In addition, does anyone can share some good starting tutorial relate with automation scripting would be appricated

Regards

[kiwi]

Hi @LinsongGuo ,

In order to get better traction for this, I have moved your query to the Cortex XSOAR area.
I would recommend that you visit this area to see your discussion and others on Cortex XSOAR.

Cheers !

-Kiwi.

[ABurt · Accepted solution]

Take a look at the automation script widgets here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/widgets/create-a-custom...

As an example for you use case (and assuming you have fields called "True Positive" and "False Positive" that are boolean (bear in mind this is pseudo code and not tested):

page = 0
size = 100

table_results = dict()

data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

while data.get('data'):
    for incident in data.get('data'):
        inc_type = incident.get('type')
        custom_fields = incident.get('CustomFields')
        if inc_type not in table_results:
            table_results[inc_type] = {
                "True Positive": int(custom_fields.get('truepositive')) or 0,
                "False Positive": int(custom_fields.get('falsepositive')) or 0,
                "Duplicate": custom_fields.get('dropppedcount') or 0,
            }
        else:
            if custom_fields.get('truepositive'):
                table_results[inc_type]['True Positive'] += 1
            if custom_fields.get('falsepositive'):
                table_results[inc_type]['False Positive'] += 1
            table_results[inc_type]['Duplicate'] += incident.get('droppedcount')
    page += 1
    data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

return_results = [{
    "Type": k,
    "True Positive": v.get('True Positive'),
    "False Positive": v.get('False Positive'),
    "Duplicate": v.get('Duplicate')
    } for k, v in table_results.items()]
    

return_results(return_results)